| शीर्षक | KodExplorer 4.52 Authorization Bypass |
|---|
| विवरण | KodExplorer v4.52 contains a post-authentication logic flaw that allows any logged-in low-privilege user to invoke the high-risk systemMember/initInstall action. Because the endpoint is not properly protected and the authorization mechanism fails open for unregistered actions, an attacker can trigger a global reinitialization process intended only for installation or administrative maintenance. In environments where an administrator has renamed a user without synchronizing the storage path, this action silently resets the victim’s directory mapping to a new empty location, causing previously existing files to disappear from the application view and resulting in cross-user data unavailability.
|
|---|
| स्रोत | ⚠️ https://vulnplus-note.wetolink.com/share/byd7AQVs42VY |
|---|
| उपयोगकर्ता | vulnplusbot (UID 96250) |
|---|
| सबमिशन | 26/03/2026 11:02 AM (6 महीनों पहले) |
|---|
| संयम | 18/04/2026 09:07 PM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 358204 [kodcloud KodExplorer तक 4.52 systemMember.class.php initInstall path अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|